Solution Guide

Ingest 53
h Unplug the target storage device and the store disk from the ruggedized
laptop; then return the store disk to the datacenter for storage and
analysis.
NOTE: Transferring an image may take a long time; six hours for a typical 60 GB
hard drive transfer is not unusual.
Ingest Using EnCase
In the Dell Digital Forensics Solution, licensing for EnCase is accomplished
using a network licensing system. Typically, an instance of EnCase SAFE is
installed on one of the datacenter servers, and a dongle containing multiple user
licenses is connected to that server. EnCase clients are configured to look to that
server for licensing, and no local dongles are required. See the Dell Digital
Forensics Installation and Configuration Guide for further information.
See
"Related Documentation and Resources" on page 16.
Also, see your network
systems administrator for information specific to your agency’s Solution
installation.
1
Attach the target storage device to the appropriate ingest workstation in the
datacenter.
a If you are imaging a SATA drive, see "Connecting the Tableau Write-
Blocker to a SATA Hard Drive" on page 55 for further information.
b If you are imaging an IDE drive, see "Connecting the Tableau Write-
Blocker to an IDE Hard Drive" on page 55 for further information.
2 Create a new case.
NOTE: The following instructions refer to the network and folder structure outlined
as Dell’s suggested best practice for its Digital Forensics Solution; see Figure 3-5 for
further information.
a
Click New , and then enter the information requested.
b On the W:\ drive (work area), create folders using the following
structure:
•
W:\[CaseName]\EnCase6\Export
• W:\[CaseName]\EnCase6\Temp
• W:\[CaseName]\EnCase6\Index
c Click Finish.
d Click Yes for each request to create the folder.